From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D4EB500953 for ; Sun, 11 Jan 2026 04:46:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768106780; cv=none; b=o5qdv0U8WzZh7RIWrBOLTbFPMNXFxhhVPj/AmcYT8DDqizCP4gCnQl69Yu9ZooeL0IKtWRISKix7g86TygDwIzQJKb08OTEy8nHoyW1KUkiiPasTSLPI6/RXR6ChOfY1UEti2TNFmLkn6UZbnJnydXqxTFEiVIPUe2LJ0Xv99Lw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768106780; c=relaxed/simple; bh=4d0MM+6hXqZN0+ZnxxA/yplOLa4mf1a54Zbd/H0Y1Fg=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=NwlOxc+u8sKXP+NY4VF2K8tMSQq5fwddvafDwqz07wB0Mm58SYibtKn19PSZ+Wtu2CqGHRNhQ9oScrm9EdQ5P4yb4ZxiaB/o6gQ9GnYhkHYCV0g+QvoBsfEfboqeTSpeqctPI4wgs7iLCtuUYJDGMqk3h8ADANqLp1QD1MhoHLw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=oCpcirYf; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="oCpcirYf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1768106766; bh=VF3gVw2PR3W28T6qenRVUx7nIwH01eHQr3/XK8BtQ8I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oCpcirYf9bTCFD3lwttr+x0mU2Ww39VLW4tAYgnk0fFCxULefuqcc7EHbp1/dMIZe BABvo6PEnNEy2VbcMml2j8tj1FrUm/wLJh5oQGudYfGZH74yMvq5t4F/0+9Rybd/6U kr23m0JT8IYQQ+pEePOeIsIcbrIKrjJERCxyPI0g= Received: from lxu-ped-host.. ([114.244.57.24]) by newxmesmtplogicsvrszc41-0.qq.com (NewEsmtp) with SMTP id B84230BF; Sun, 11 Jan 2026 12:46:04 +0800 X-QQ-mid: xmsmtpt1768106764tjzd1gr9c Message-ID: X-QQ-XMAILINFO: NmRjDopJZVxOoUtjSQCD34zEDfkKadc6vp2TVDY0luw/IUcJwz4jhtfIrHXRpn jNI2sVzHv5koVc6l2qH26cFbqgNCkriJT8RJNrnfg/ZN3oxGuFlCEUDZxPU4khCiGrTcQAHCJNYi 75lFjPhaVB6+MHVykBOVOIY38vgmt//L0WGo5+aRwVS7jSTAV098rsvR0SgONR31yxcbabiOsiSZ lnKx3qD9OSepfBPB7TOn7XUN15oukK32HgbT1K6X9UNDK6VAnJBtTOPXqWIBWpZgVcfECja8l7LI 6/8kAUokRz//FUDTAyWt43CKHy93CXPIirbvNdKHEsGNqMOz2sl59RAF61K3k71k7OKCt6lho8/h hTT3UWrDXuoraj5EfhIkFssqDEn4jx4lVj6fbhj0ABfIqhzueJ8VkWgQB9iAOruh4Jg3ycbPNFAO CLwD1Z/q1//jxqyBI+mU5tL7J9gzHWNYJQlEKJgDHlk2z/foPBQNi8mrUZ+uaplcH+pU5vmRTzjo kW3JsIAAXWvpdVlW1aR+cNWehUQ1TPkM82mG5Tr+VKWHyTGXw5d2uXTXQA+OsTfP1VsuEDSEndSF Gm70Coo0wwtHnQx5JwTavOOEclBfWuf2l+yrr4KJMa+tYW6aLH114eEZ+HPb81ktuKw0hR3V/0rX +GPByBRMuCDGfo+BAYgw2K9iwECgpZaiRUYnUrWlrt0LdQ/AA/cmeV2pZJTB6THXxUJjVLOeW+R0 GwwBY/wAOvZGcLQC+IQO1oUfInnjVkTtFRMxx+WKgwKGqG0+I3qjncPMHosiJDXVp4OfD0AQbCOw Yd/xCGPBJ6h4FlwUHXaYCcO0qa36yVOY8UDcbW0Z8RnKEwuHlE0LlApdu6xljrBPXCjhMpnoJuJu 4JkDIC5NzqvktsdeaSE53stT0Rw/rbQp5rzMzbMzrAMn5c+8hcb67aKc1vqtB9XQBW1QT68U0yCU EUOFrkyK7+1o5IKZicp/CyOHREJGBDHXdemmyl3SE= X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== From: Edward Adam Davis To: syzbot+16062f26c6480975e5ed@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [media?] KASAN: slab-use-after-free Read in em28xx_release_resources Date: Sun, 11 Jan 2026 12:46:05 +0800 X-OQ-MSGID: <20260111044604.608108-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69608280.050a0220.1c677c.03b0.GAE@google.com> References: <69608280.050a0220.1c677c.03b0.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c index 2dfa3242a7ab..490ac7548fa3 100644 --- a/drivers/media/usb/em28xx/em28xx-video.c +++ b/drivers/media/usb/em28xx/em28xx-video.c @@ -882,9 +882,12 @@ static void em28xx_v4l2_media_release(struct em28xx *dev) for (i = 0; i < MAX_EM28XX_INPUT; i++) { if (!INPUT(i)->type) - return; + break; media_device_unregister_entity(&dev->input_ent[i]); } + media_device_unregister_entity(&dev->v4l2->vdev.entity); + if (em28xx_vbi_supported(dev)) + media_device_unregister_entity(&dev->v4l2->vbi_dev.entity); #endif } @@ -2126,10 +2129,19 @@ static int em28xx_v4l2_open(struct file *filp) { struct video_device *vdev = video_devdata(filp); struct em28xx *dev = video_drvdata(filp); - struct em28xx_v4l2 *v4l2 = dev->v4l2; + struct em28xx_v4l2 *v4l2; enum v4l2_buf_type fh_type = 0; int ret; + if (mutex_lock_interruptible(&dev->lock)) + return -ERESTARTSYS; + + v4l2 = dev->v4l2; + if (!v4l2) { + mutex_unlock(&dev->lock); + return -EIO; + } + switch (vdev->vfl_type) { case VFL_TYPE_VIDEO: fh_type = V4L2_BUF_TYPE_VIDEO_CAPTURE; @@ -2140,6 +2152,7 @@ static int em28xx_v4l2_open(struct file *filp) case VFL_TYPE_RADIO: break; default: + mutex_unlock(&dev->lock); return -EINVAL; } @@ -2147,8 +2160,6 @@ static int em28xx_v4l2_open(struct file *filp) video_device_node_name(vdev), v4l2_type_names[fh_type], v4l2->users); - if (mutex_lock_interruptible(&dev->lock)) - return -ERESTARTSYS; ret = v4l2_fh_open(filp); if (ret) { diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c index 10a126e50c1c..72dd761d6ec8 100644 --- a/drivers/media/v4l2-core/v4l2-dev.c +++ b/drivers/media/v4l2-core/v4l2-dev.c @@ -441,6 +441,9 @@ static int v4l2_open(struct inode *inode, struct file *filp) } done: + if (ret == -EIO) + return ret; + if (vdev->dev_debug & V4L2_DEV_DEBUG_FOP) dprintk("%s: open (%d)\n", video_device_node_name(vdev), ret);